@peterhauge/apiops-cli 0.1.3-alpha.0

package/dist/services/keyvault-checker.js

@@ -0,0 +1,390 @@
+/**
+ * Key Vault access pre-flight check for KeyVault-backed NamedValues.
+ *
+ * Validates that the APIM service's managed identity has been granted access
+ * to the Key Vault secret. Uses Azure ARM APIs to:
+ *   1. Retrieve the APIM service identity (system- or user-assigned)
+ *   2. Locate the Key Vault resource in the subscription
+ *   3. Check RBAC role assignments or access policies
+ *
+ * This check is best-effort when infrastructure queries fail (ARM token,
+ * vault in another subscription, etc.) — a warning is logged and the check
+ * is skipped. Hard errors are raised only for definitive misconfigurations
+ * such as "APIM has no managed identity" or "no matching RBAC / access policy".
+ */
+import { DefaultAzureCredential } from '@azure/identity';
+import { logger } from '../lib/logger.js';
+import { USER_AGENT } from '../lib/user-agent.js';
+/* ------------------------------------------------------------------ */
+/*  ARM API versions                                                  */
+/* ------------------------------------------------------------------ */
+const APIM_API_VERSION = '2024-05-01';
+const RESOURCES_API_VERSION = '2021-04-01';
+const KEYVAULT_API_VERSION = '2023-07-01';
+const AUTHZ_API_VERSION = '2022-04-01';
+/** ARM management scope */
+const ARM_SCOPE = 'https://management.azure.com/.default';
+/**
+ * Well-known Azure RBAC role-definition GUIDs that grant
+ * the `Microsoft.KeyVault/vaults/secrets/getSecret/action` data-action.
+ * Used only as a fast-path optimisation — if none match we still resolve
+ * each role definition to inspect its dataActions.
+ */
+const SECRET_GET_ROLE_IDS = new Set([
+    '4633458b-17de-408a-b874-0445c86b69e6', // Key Vault Secrets User
+    'b86a8fe4-44ce-4948-aee5-eccb2c155cd7', // Key Vault Secrets Officer
+    '00482a5a-887f-4fb3-b363-3b7fe8e74483', // Key Vault Administrator
+]);
+/* ------------------------------------------------------------------ */
+/*  Public types                                                      */
+/* ------------------------------------------------------------------ */
+/**
+ * Error thrown when the APIM managed identity clearly lacks access to
+ * Key Vault, or the APIM service is missing the required identity
+ * configuration. Signals that the publish should fail immediately.
+ */
+export class KeyVaultAccessError extends Error {
+    constructor(message, options) {
+        super(message, options);
+        this.name = 'KeyVaultAccessError';
+    }
+}
+/* ------------------------------------------------------------------ */
+/*  Default production implementations                                */
+/* ------------------------------------------------------------------ */
+function defaultTokenProviderFactory() {
+    return new DefaultAzureCredential();
+}
+async function defaultArmRequest(url, token) {
+    const headers = new Headers();
+    headers.set('Authorization', `Bearer ${token}`);
+    headers.set('Accept', 'application/json');
+    headers.set('User-Agent', USER_AGENT);
+    const response = await fetch(url, { headers });
+    return {
+        status: response.status,
+        json: () => response.json(),
+    };
+}
+/* ------------------------------------------------------------------ */
+/*  Main entry point                                                  */
+/* ------------------------------------------------------------------ */
+/**
+ * Verify that the APIM service's managed identity has access to the
+ * specified Key Vault secret via ARM RBAC or access policies.
+ *
+ * @param secretIdentifier  Full Key Vault secret URI, e.g.
+ *   `https://myvault.vault.azure.net/secrets/my-secret[/version]`
+ * @param identityClientId  Client ID of the user-assigned managed identity
+ *   that APIM will use. Omit for system-assigned identity.
+ * @param apimContext  Subscription / resource-group / service-name of the
+ *   APIM instance.
+ * @param tokenProviderFactory  (testing) Override the ARM credential.
+ * @param armRequest  (testing) Override the HTTP call.
+ */
+export async function checkKeyVaultSecretAccess(secretIdentifier, identityClientId, apimContext, tokenProviderFactory = defaultTokenProviderFactory, armRequest = defaultArmRequest) {
+    /* ---- 1. Parse vault name & secret name from the URI ---- */
+    let vaultName;
+    let secretName;
+    try {
+        const url = new URL(secretIdentifier);
+        vaultName = url.hostname.split('.')[0];
+        const segments = url.pathname.split('/').filter(Boolean);
+        secretName = segments[1] ?? '';
+        if (!secretName)
+            throw new Error('Missing secret name in path');
+        if (!vaultName)
+            throw new Error('Missing vault name in host');
+    }
+    catch (error) {
+        throw new KeyVaultAccessError(`Invalid Key Vault secretIdentifier: '${secretIdentifier}'`, { cause: error });
+    }
+    /* ---- 2. Acquire ARM token ---- */
+    const credential = tokenProviderFactory();
+    let token;
+    try {
+        token = (await credential.getToken(ARM_SCOPE)).token;
+    }
+    catch (error) {
+        logger.warn(`Unable to acquire ARM token — skipping Key Vault pre-flight check. ` +
+            `(Error: ${error.message})`);
+        return;
+    }
+    /* ---- 3. Get APIM service identity ---- */
+    const { principalId, identityLabel } = await resolveApimPrincipal(apimContext, identityClientId, token, armRequest);
+    if (!principalId)
+        return; // soft-skip — warning already logged
+    logger.debug(`Pre-flight: APIM ${identityLabel} principalId = ${principalId}`);
+    /* ---- 4. Locate the vault in the same subscription ---- */
+    const vault = await findVaultInSubscription(apimContext.subscriptionId, vaultName, token, armRequest);
+    if (!vault)
+        return; // soft-skip — warning already logged
+    /* ---- 5. Check RBAC or access-policy permissions ---- */
+    const vaultProps = vault.json
+        .properties;
+    if (vaultProps?.enableRbacAuthorization === true) {
+        await checkRbacAccess(vault.resourceId, principalId, identityLabel, vaultName, secretName, token, armRequest);
+    }
+    else {
+        checkAccessPolicies(vaultProps, principalId, identityLabel, vaultName, secretName);
+    }
+    logger.debug(`Key Vault access confirmed for APIM ${identityLabel} ` +
+        `on secret '${secretName}' in vault '${vaultName}'`);
+}
+/* ------------------------------------------------------------------ */
+/*  Internal helpers                                                  */
+/* ------------------------------------------------------------------ */
+/**
+ * Resolve the APIM managed-identity principal ID via the ARM service resource.
+ *
+ * Returns `{ principalId, identityLabel }` on success.
+ * Throws `KeyVaultAccessError` when APIM has no identity or the specified
+ * user-assigned identity is not found.
+ * Returns `{ principalId: undefined }` when the ARM call itself fails
+ * (warns and degrades gracefully).
+ */
+async function resolveApimPrincipal(ctx, identityClientId, token, armRequest) {
+    const identityLabel = identityClientId
+        ? `user-assigned identity '${identityClientId}'`
+        : 'system-assigned identity';
+    const apimUrl = `https://management.azure.com/subscriptions/${ctx.subscriptionId}` +
+        `/resourceGroups/${ctx.resourceGroup}` +
+        `/providers/Microsoft.ApiManagement/service/${ctx.serviceName}` +
+        `?api-version=${APIM_API_VERSION}`;
+    let apimJson;
+    try {
+        const resp = await armRequest(apimUrl, token);
+        if (resp.status !== 200) {
+            logger.warn(`Failed to fetch APIM service (HTTP ${resp.status}) — ` +
+                `skipping Key Vault pre-flight check.`);
+            return { principalId: undefined, identityLabel };
+        }
+        apimJson = (await resp.json());
+    }
+    catch (error) {
+        logger.warn(`Failed to fetch APIM service — skipping Key Vault pre-flight check. ` +
+            `(Error: ${error.message})`);
+        return { principalId: undefined, identityLabel };
+    }
+    const identity = apimJson.identity;
+    if (!identity) {
+        throw new KeyVaultAccessError(`APIM service '${ctx.serviceName}' has no managed identity configured. ` +
+            `KeyVault-backed NamedValues require a managed identity to access secrets.`);
+    }
+    let principalId;
+    if (identityClientId) {
+        // User-assigned: find the matching clientId in userAssignedIdentities
+        const uaMap = identity.userAssignedIdentities;
+        if (uaMap) {
+            for (const entry of Object.values(uaMap)) {
+                if (entry.clientId === identityClientId) {
+                    principalId = entry.principalId;
+                    break;
+                }
+            }
+        }
+        if (!principalId) {
+            throw new KeyVaultAccessError(`User-assigned managed identity with clientId '${identityClientId}' ` +
+                `not found on APIM service '${ctx.serviceName}'.`);
+        }
+    }
+    else {
+        principalId = identity.principalId;
+        if (!principalId) {
+            throw new KeyVaultAccessError(`APIM service '${ctx.serviceName}' has no system-assigned managed ` +
+                `identity enabled. KeyVault-backed NamedValues require a managed identity.`);
+        }
+    }
+    return { principalId, identityLabel };
+}
+/**
+ * Search for a Key Vault resource in the given subscription by vault name.
+ * Returns the vault's resource ID and its full JSON, or `undefined` when the
+ * vault is not found (e.g. it lives in a different subscription).
+ */
+async function findVaultInSubscription(subscriptionId, vaultName, token, armRequest) {
+    const filter = encodeURIComponent(`resourceType eq 'Microsoft.KeyVault/vaults' and name eq '${vaultName}'`);
+    const listUrl = `https://management.azure.com/subscriptions/${subscriptionId}` +
+        `/resources?$filter=${filter}&api-version=${RESOURCES_API_VERSION}`;
+    let vaultResourceId;
+    try {
+        const resp = await armRequest(listUrl, token);
+        if (resp.status !== 200) {
+            logger.warn(`Failed to search for Key Vault '${vaultName}' (HTTP ${resp.status}) — ` +
+                `skipping pre-flight check.`);
+            return undefined;
+        }
+        const body = (await resp.json());
+        vaultResourceId = body.value?.[0]?.id;
+    }
+    catch (error) {
+        logger.warn(`Failed to search for Key Vault '${vaultName}' — skipping pre-flight check. ` +
+            `(Error: ${error.message})`);
+        return undefined;
+    }
+    if (!vaultResourceId) {
+        logger.warn(`Key Vault '${vaultName}' not found in subscription '${subscriptionId}'. ` +
+            `It may be in a different subscription — skipping pre-flight access check.`);
+        return undefined;
+    }
+    // GET the vault resource to read properties (RBAC mode, access policies)
+    const vaultUrl = `https://management.azure.com${vaultResourceId}` +
+        `?api-version=${KEYVAULT_API_VERSION}`;
+    try {
+        const resp = await armRequest(vaultUrl, token);
+        if (resp.status !== 200) {
+            logger.warn(`Failed to read Key Vault '${vaultName}' (HTTP ${resp.status}) — ` +
+                `skipping pre-flight check.`);
+            return undefined;
+        }
+        const json = await resp.json();
+        return { resourceId: vaultResourceId, json };
+    }
+    catch (error) {
+        logger.warn(`Failed to read Key Vault '${vaultName}' — skipping pre-flight check. ` +
+            `(Error: ${error.message})`);
+        return undefined;
+    }
+}
+/** The data-action that grants secret read access in Key Vault RBAC. */
+const SECRET_GET_DATA_ACTION = 'microsoft.keyvault/vaults/secrets/getsecret/action';
+/** Wildcard patterns that also grant the secret-get data-action. */
+const SECRET_GET_WILDCARDS = [
+    'microsoft.keyvault/vaults/secrets/*',
+    'microsoft.keyvault/vaults/*',
+    'microsoft.keyvault/*',
+    '*',
+];
+/**
+ * RBAC-mode check: list role assignments on the vault for the given principal.
+ * Throws `KeyVaultAccessError` when no assignments exist at all, or when
+ * none of the assigned roles grant the secret-get data-action.
+ *
+ * Strategy (fast-path first):
+ *   1. Check if any assignment matches a well-known role GUID — skip role
+ *      definition resolution if so.
+ *   2. Otherwise, GET each role definition and inspect its `permissions[].dataActions`
+ *      for the `Microsoft.KeyVault/vaults/secrets/getSecret/action` data-action.
+ */
+async function checkRbacAccess(vaultResourceId, principalId, identityLabel, vaultName, secretName, token, armRequest) {
+    const filter = encodeURIComponent(`principalId eq '${principalId}'`);
+    const url = `https://management.azure.com${vaultResourceId}` +
+        `/providers/Microsoft.Authorization/roleAssignments` +
+        `?$filter=${filter}&api-version=${AUTHZ_API_VERSION}`;
+    let assignments;
+    try {
+        const resp = await armRequest(url, token);
+        if (resp.status !== 200) {
+            logger.warn(`Failed to list role assignments (HTTP ${resp.status}) — ` +
+                `skipping RBAC pre-flight check for '${vaultName}'.`);
+            return;
+        }
+        const body = (await resp.json());
+        assignments = body.value ?? [];
+    }
+    catch (error) {
+        logger.warn(`Failed to list role assignments — skipping RBAC pre-flight check. ` +
+            `(Error: ${error.message})`);
+        return;
+    }
+    if (assignments.length === 0) {
+        throw new KeyVaultAccessError(`APIM ${identityLabel} (principalId: ${principalId}) has no RBAC role ` +
+            `assignments on Key Vault '${vaultName}'. ` +
+            `Grant the identity 'Key Vault Secrets User' role on the vault ` +
+            `so APIM can read secret '${secretName}'.`);
+    }
+    // --- Fast path: match well-known role GUIDs ---
+    const hasKnownRole = assignments.some((a) => {
+        const roleDefId = a.properties?.roleDefinitionId ?? '';
+        const roleGuid = roleDefId.split('/').pop()?.toLowerCase() ?? '';
+        return SECRET_GET_ROLE_IDS.has(roleGuid);
+    });
+    if (hasKnownRole) {
+        return; // confirmed — no need to resolve definitions
+    }
+    // --- Slow path: resolve each role definition and check dataActions ---
+    logger.debug(`No well-known secret role found; resolving ${assignments.length} role ` +
+        `definition(s) to check dataActions.`);
+    for (const assignment of assignments) {
+        const roleDefId = assignment.properties?.roleDefinitionId ?? '';
+        if (!roleDefId)
+            continue;
+        const hasAccess = await roleDefinitionGrantsSecretGet(roleDefId, token, armRequest);
+        if (hasAccess)
+            return; // confirmed via dataActions
+    }
+    throw new KeyVaultAccessError(`APIM ${identityLabel} (principalId: ${principalId}) has ` +
+        `${assignments.length} RBAC role assignment(s) on Key Vault '${vaultName}', ` +
+        `but none grant the '${SECRET_GET_DATA_ACTION}' data-action. ` +
+        `Grant the identity 'Key Vault Secrets User' role on the vault ` +
+        `so APIM can read secret '${secretName}'.`);
+}
+/**
+ * GET a role definition by its full ARM ID and check whether any of its
+ * `permissions[].dataActions` grant the secret-get data-action.
+ *
+ * Returns `undefined` (rather than `false`) when the definition cannot be
+ * fetched — the caller should treat this as inconclusive and keep checking.
+ */
+async function roleDefinitionGrantsSecretGet(roleDefinitionId, token, armRequest) {
+    const url = `https://management.azure.com${roleDefinitionId}` +
+        `?api-version=${AUTHZ_API_VERSION}`;
+    let json;
+    try {
+        const resp = await armRequest(url, token);
+        if (resp.status !== 200) {
+            logger.debug(`Failed to fetch role definition (HTTP ${resp.status}): ${roleDefinitionId}`);
+            return undefined;
+        }
+        json = (await resp.json());
+    }
+    catch {
+        return undefined;
+    }
+    const props = json.properties;
+    const permissions = (props?.permissions ?? []);
+    for (const perm of permissions) {
+        const dataActions = (perm.dataActions ?? []);
+        const hasAction = dataActions.some((da) => {
+            const lower = da.toLowerCase();
+            return lower === SECRET_GET_DATA_ACTION ||
+                SECRET_GET_WILDCARDS.includes(lower);
+        });
+        if (hasAction) {
+            // Also check notDataActions don't deny it
+            const notDataActions = (perm.notDataActions ?? []);
+            const denied = notDataActions.some((nda) => {
+                const lower = nda.toLowerCase();
+                return lower === SECRET_GET_DATA_ACTION ||
+                    SECRET_GET_WILDCARDS.includes(lower);
+            });
+            if (!denied)
+                return true;
+        }
+    }
+    return false;
+}
+/**
+ * Access-policy mode check: scan the vault's `accessPolicies` array for the
+ * APIM principal with `secrets.get` permission.
+ * Throws `KeyVaultAccessError` when no matching policy is found.
+ */
+function checkAccessPolicies(vaultProperties, principalId, identityLabel, vaultName, secretName) {
+    const policies = vaultProperties?.accessPolicies ?? [];
+    const match = policies.find((p) => {
+        if (p.objectId?.toLowerCase() !== principalId.toLowerCase()) {
+            return false;
+        }
+        const perms = p.permissions;
+        const secretPerms = perms?.secrets ?? [];
+        return secretPerms.some((s) => s.toLowerCase() === 'get' || s.toLowerCase() === 'all');
+    });
+    if (!match) {
+        throw new KeyVaultAccessError(`APIM ${identityLabel} (principalId: ${principalId}) does not have an ` +
+            `access policy with 'get' secret permission on Key Vault '${vaultName}'. ` +
+            `Add an access policy granting 'get' on secrets for the identity, ` +
+            `or enable RBAC authorization and assign 'Key Vault Secrets User'. ` +
+            `Secret: '${secretName}'.`);
+    }
+}
+//# sourceMappingURL=keyvault-checker.js.map

package/dist/services/keyvault-checker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyvault-checker.js","sourceRoot":"","sources":["../../src/services/keyvault-checker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAElD,wEAAwE;AACxE,wEAAwE;AACxE,wEAAwE;AACxE,MAAM,gBAAgB,GAAG,YAAY,CAAC;AACtC,MAAM,qBAAqB,GAAG,YAAY,CAAC;AAC3C,MAAM,oBAAoB,GAAG,YAAY,CAAC;AAC1C,MAAM,iBAAiB,GAAG,YAAY,CAAC;AAEvC,2BAA2B;AAC3B,MAAM,SAAS,GAAG,uCAAuC,CAAC;AAE1D;;;;;GAKG;AACH,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,sCAAsC,EAAE,yBAAyB;IACjE,sCAAsC,EAAE,4BAA4B;IACpE,sCAAsC,EAAE,0BAA0B;CACnE,CAAC,CAAC;AAEH,wEAAwE;AACxE,wEAAwE;AACxE,wEAAwE;AAExE;;;;GAIG;AACH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,OAAe,EAAE,OAAsB;QACjD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AA0BD,wEAAwE;AACxE,wEAAwE;AACxE,wEAAwE;AAExE,SAAS,2BAA2B;IAClC,OAAO,IAAI,sBAAsB,EAAE,CAAC;AACtC,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,GAAW,EAAE,KAAa;IACzD,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,KAAK,EAAE,CAAC,CAAC;IAChD,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;IAC1C,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAC/C,OAAO;QACL,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,IAAI,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAsB;KAChD,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,wEAAwE;AACxE,wEAAwE;AAExE;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,gBAAwB,EACxB,gBAAoC,EACpC,WAAiC,EACjC,uBAA6C,2BAA2B,EACxE,aAA2B,iBAAiB;IAE5C,8DAA8D;IAC9D,IAAI,SAAiB,CAAC;IACtB,IAAI,UAAkB,CAAC;IAEvB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAC;QACtC,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACvC,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACzD,UAAU,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAChE,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,mBAAmB,CAC3B,wCAAwC,gBAAgB,GAAG,EAC3D,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC;IAED,oCAAoC;IACpC,MAAM,UAAU,GAAG,oBAAoB,EAAE,CAAC;IAC1C,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,CAAC,MAAM,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;IACvD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CACT,qEAAqE;YACrE,WAAY,KAAe,CAAC,OAAO,GAAG,CACvC,CAAC;QACF,OAAO;IACT,CAAC;IAED,4CAA4C;IAC5C,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,GAAG,MAAM,oBAAoB,CAC/D,WAAW,EACX,gBAAgB,EAChB,KAAK,EACL,UAAU,CACX,CAAC;IACF,IAAI,CAAC,WAAW;QAAE,OAAO,CAAC,qCAAqC;IAE/D,MAAM,CAAC,KAAK,CACV,oBAAoB,aAAa,kBAAkB,WAAW,EAAE,CACjE,CAAC;IAEF,4DAA4D;IAC5D,MAAM,KAAK,GAAG,MAAM,uBAAuB,CACzC,WAAW,CAAC,cAAc,EAC1B,SAAS,EACT,KAAK,EACL,UAAU,CACX,CAAC;IACF,IAAI,CAAC,KAAK;QAAE,OAAO,CAAC,qCAAqC;IAEzD,0DAA0D;IAC1D,MAAM,UAAU,GAAI,KAAK,CAAC,IAAgC;SACvD,UAAqC,CAAC;IAEzC,IAAI,UAAU,EAAE,uBAAuB,KAAK,IAAI,EAAE,CAAC;QACjD,MAAM,eAAe,CACnB,KAAK,CAAC,UAAU,EAChB,WAAW,EACX,aAAa,EACb,SAAS,EACT,UAAU,EACV,KAAK,EACL,UAAU,CACX,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,mBAAmB,CACjB,UAAU,EACV,WAAW,EACX,aAAa,EACb,SAAS,EACT,UAAU,CACX,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,KAAK,CACV,uCAAuC,aAAa,GAAG;QACvD,cAAc,UAAU,eAAe,SAAS,GAAG,CACpD,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,wEAAwE;AACxE,wEAAwE;AAExE;;;;;;;;GAQG;AACH,KAAK,UAAU,oBAAoB,CACjC,GAAyB,EACzB,gBAAoC,EACpC,KAAa,EACb,UAAwB;IAExB,MAAM,aAAa,GAAG,gBAAgB;QACpC,CAAC,CAAC,2BAA2B,gBAAgB,GAAG;QAChD,CAAC,CAAC,0BAA0B,CAAC;IAE/B,MAAM,OAAO,GACX,8CAA8C,GAAG,CAAC,cAAc,EAAE;QAClE,mBAAmB,GAAG,CAAC,aAAa,EAAE;QACtC,8CAA8C,GAAG,CAAC,WAAW,EAAE;QAC/D,gBAAgB,gBAAgB,EAAE,CAAC;IAErC,IAAI,QAAiC,CAAC;IACtC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC9C,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACxB,MAAM,CAAC,IAAI,CACT,sCAAsC,IAAI,CAAC,MAAM,MAAM;gBACvD,sCAAsC,CACvC,CAAC;YACF,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC;QACnD,CAAC;QACD,QAAQ,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAA4B,CAAC;IAC5D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CACT,sEAAsE;YACtE,WAAY,KAAe,CAAC,OAAO,GAAG,CACvC,CAAC;QACF,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC;IACnD,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAA+C,CAAC;IAE1E,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,mBAAmB,CAC3B,iBAAiB,GAAG,CAAC,WAAW,wCAAwC;YACxE,2EAA2E,CAC5E,CAAC;IACJ,CAAC;IAED,IAAI,WAA+B,CAAC;IAEpC,IAAI,gBAAgB,EAAE,CAAC;QACrB,sEAAsE;QACtE,MAAM,KAAK,GAAG,QAAQ,CAAC,sBAEV,CAAC;QACd,IAAI,KAAK,EAAE,CAAC;YACV,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzC,IAAI,KAAK,CAAC,QAAQ,KAAK,gBAAgB,EAAE,CAAC;oBACxC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;oBAChC,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,mBAAmB,CAC3B,iDAAiD,gBAAgB,IAAI;gBACrE,8BAA8B,GAAG,CAAC,WAAW,IAAI,CAClD,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,CAAC;QACN,WAAW,GAAG,QAAQ,CAAC,WAAiC,CAAC;QACzD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,mBAAmB,CAC3B,iBAAiB,GAAG,CAAC,WAAW,mCAAmC;gBACnE,2EAA2E,CAC5E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC;AACxC,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,uBAAuB,CACpC,cAAsB,EACtB,SAAiB,EACjB,KAAa,EACb,UAAwB;IAExB,MAAM,MAAM,GAAG,kBAAkB,CAC/B,4DAA4D,SAAS,GAAG,CACzE,CAAC;IACF,MAAM,OAAO,GACX,8CAA8C,cAAc,EAAE;QAC9D,sBAAsB,MAAM,gBAAgB,qBAAqB,EAAE,CAAC;IAEtE,IAAI,eAAmC,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC9C,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACxB,MAAM,CAAC,IAAI,CACT,mCAAmC,SAAS,WAAW,IAAI,CAAC,MAAM,MAAM;gBACxE,4BAA4B,CAC7B,CAAC;YACF,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAsC,CAAC;QACtE,eAAe,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACxC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CACT,mCAAmC,SAAS,iCAAiC;YAC7E,WAAY,KAAe,CAAC,OAAO,GAAG,CACvC,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,MAAM,CAAC,IAAI,CACT,cAAc,SAAS,gCAAgC,cAAc,KAAK;YAC1E,2EAA2E,CAC5E,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,yEAAyE;IACzE,MAAM,QAAQ,GACZ,+BAA+B,eAAe,EAAE;QAChD,gBAAgB,oBAAoB,EAAE,CAAC;IAEzC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC/C,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACxB,MAAM,CAAC,IAAI,CACT,6BAA6B,SAAS,WAAW,IAAI,CAAC,MAAM,MAAM;gBAClE,4BAA4B,CAC7B,CAAC;YACF,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC/B,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;IAC/C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CACT,6BAA6B,SAAS,iCAAiC;YACvE,WAAY,KAAe,CAAC,OAAO,GAAG,CACvC,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,wEAAwE;AACxE,MAAM,sBAAsB,GAAG,oDAAoD,CAAC;AAEpF,oEAAoE;AACpE,MAAM,oBAAoB,GAAG;IAC3B,qCAAqC;IACrC,6BAA6B;IAC7B,sBAAsB;IACtB,GAAG;CACJ,CAAC;AAEF;;;;;;;;;;GAUG;AACH,KAAK,UAAU,eAAe,CAC5B,eAAuB,EACvB,WAAmB,EACnB,aAAqB,EACrB,SAAiB,EACjB,UAAkB,EAClB,KAAa,EACb,UAAwB;IAExB,MAAM,MAAM,GAAG,kBAAkB,CAAC,mBAAmB,WAAW,GAAG,CAAC,CAAC;IACrE,MAAM,GAAG,GACP,+BAA+B,eAAe,EAAE;QAChD,oDAAoD;QACpD,YAAY,MAAM,gBAAgB,iBAAiB,EAAE,CAAC;IAExD,IAAI,WAA2C,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC1C,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACxB,MAAM,CAAC,IAAI,CACT,yCAAyC,IAAI,CAAC,MAAM,MAAM;gBAC1D,uCAAuC,SAAS,IAAI,CACrD,CAAC;YACF,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAE9B,CAAC;QACF,WAAW,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CACT,oEAAoE;YACpE,WAAY,KAAe,CAAC,OAAO,GAAG,CACvC,CAAC;QACF,OAAO;IACT,CAAC;IAED,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,mBAAmB,CAC3B,QAAQ,aAAa,kBAAkB,WAAW,qBAAqB;YACvE,6BAA6B,SAAS,KAAK;YAC3C,gEAAgE;YAChE,4BAA4B,UAAU,IAAI,CAC3C,CAAC;IACJ,CAAC;IAED,iDAAiD;IACjD,MAAM,YAAY,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QAC1C,MAAM,SAAS,GACZ,CAAC,CAAC,UAAsC,EAAE,gBAC5C,IAAI,EAAE,CAAC;QACR,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;QACjE,OAAO,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,CAAC,6CAA6C;IACvD,CAAC;IAED,wEAAwE;IACxE,MAAM,CAAC,KAAK,CACV,8CAA8C,WAAW,CAAC,MAAM,QAAQ;QACxE,qCAAqC,CACtC,CAAC;IAEF,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,MAAM,SAAS,GACZ,UAAU,CAAC,UAAsC,EAAE,gBACrD,IAAI,EAAE,CAAC;QACR,IAAI,CAAC,SAAS;YAAE,SAAS;QAEzB,MAAM,SAAS,GAAG,MAAM,6BAA6B,CACnD,SAAS,EAAE,KAAK,EAAE,UAAU,CAC7B,CAAC;QACF,IAAI,SAAS;YAAE,OAAO,CAAC,4BAA4B;IACrD,CAAC;IAED,MAAM,IAAI,mBAAmB,CAC3B,QAAQ,aAAa,kBAAkB,WAAW,QAAQ;QAC1D,GAAG,WAAW,CAAC,MAAM,0CAA0C,SAAS,KAAK;QAC7E,uBAAuB,sBAAsB,iBAAiB;QAC9D,gEAAgE;QAChE,4BAA4B,UAAU,IAAI,CAC3C,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,6BAA6B,CAC1C,gBAAwB,EACxB,KAAa,EACb,UAAwB;IAExB,MAAM,GAAG,GACP,+BAA+B,gBAAgB,EAAE;QACjD,gBAAgB,iBAAiB,EAAE,CAAC;IAEtC,IAAI,IAA6B,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC1C,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACxB,MAAM,CAAC,KAAK,CACV,yCAAyC,IAAI,CAAC,MAAM,MAAM,gBAAgB,EAAE,CAC7E,CAAC;YACF,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAA4B,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,UAAiD,CAAC;IACrE,MAAM,WAAW,GAAG,CAAC,KAAK,EAAE,WAAW,IAAI,EAAE,CAAmC,CAAC;IAEjF,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,MAAM,WAAW,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAa,CAAC;QACzD,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE;YACxC,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;YAC/B,OAAO,KAAK,KAAK,sBAAsB;gBACrC,oBAAoB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;QACH,IAAI,SAAS,EAAE,CAAC;YACd,0CAA0C;YAC1C,MAAM,cAAc,GAAG,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAAa,CAAC;YAC/D,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;gBACzC,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;gBAChC,OAAO,KAAK,KAAK,sBAAsB;oBACrC,oBAAoB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YACzC,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAC1B,eAAwC,EACxC,WAAmB,EACnB,aAAqB,EACrB,SAAiB,EACjB,UAAkB;IAElB,MAAM,QAAQ,GACX,eAAe,EAAE,cAAiD,IAAI,EAAE,CAAC;IAE5E,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QAChC,IAAK,CAAC,CAAC,QAAmB,EAAE,WAAW,EAAE,KAAK,WAAW,CAAC,WAAW,EAAE,EAAE,CAAC;YACxE,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,KAAK,GAAG,CAAC,CAAC,WAAkD,CAAC;QACnE,MAAM,WAAW,GAAI,KAAK,EAAE,OAAoB,IAAI,EAAE,CAAC;QACvD,OAAO,WAAW,CAAC,IAAI,CACrB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,CAC9D,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,mBAAmB,CAC3B,QAAQ,aAAa,kBAAkB,WAAW,qBAAqB;YACvE,4DAA4D,SAAS,KAAK;YAC1E,mEAAmE;YACnE,oEAAoE;YACpE,YAAY,UAAU,IAAI,CAC3B,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/services/override-merger.d.ts

@@ -0,0 +1,20 @@
+/**
+ * T033: Override merger service
+ * Apply environment-specific overrides from OverrideConfig to resource JSON payloads.
+ * Deep-merges with case-insensitive key matching; warns on unknown override keys.
+ */
+import { ResourceDescriptor } from '../models/types.js';
+import { OverrideConfig } from '../models/config.js';
+/**
+ * Apply environment overrides from OverrideConfig to a resource JSON payload.
+ * Deep-merges matching override properties using case-insensitive key matching.
+ * Logs a warning for any override keys that don't match resource type.
+ * Returns a new object (does not mutate input).
+ *
+ * @param descriptor - Resource descriptor (type + name identify the resource)
+ * @param json - Original resource JSON payload
+ * @param overrides - Environment-specific override configuration
+ * @returns New JSON object with overrides applied
+ */
+export declare function applyOverrides(descriptor: ResourceDescriptor, json: Record<string, unknown>, overrides: OverrideConfig | undefined): Record<string, unknown>;
+//# sourceMappingURL=override-merger.d.ts.map

package/dist/services/override-merger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"override-merger.d.ts","sourceRoot":"","sources":["../../src/services/override-merger.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAExD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAIrD;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAC5B,UAAU,EAAE,kBAAkB,EAC9B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,SAAS,EAAE,cAAc,GAAG,SAAS,GACpC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAsCzB"}

package/dist/services/override-merger.js

@@ -0,0 +1,102 @@
+/**
+ * T033: Override merger service
+ * Apply environment-specific overrides from OverrideConfig to resource JSON payloads.
+ * Deep-merges with case-insensitive key matching; warns on unknown override keys.
+ */
+import { ResourceType } from '../models/resource-types.js';
+import { logger } from '../lib/logger.js';
+import { getNameFromNameParts } from '../lib/resource-path.js';
+/**
+ * Apply environment overrides from OverrideConfig to a resource JSON payload.
+ * Deep-merges matching override properties using case-insensitive key matching.
+ * Logs a warning for any override keys that don't match resource type.
+ * Returns a new object (does not mutate input).
+ *
+ * @param descriptor - Resource descriptor (type + name identify the resource)
+ * @param json - Original resource JSON payload
+ * @param overrides - Environment-specific override configuration
+ * @returns New JSON object with overrides applied
+ */
+export function applyOverrides(descriptor, json, overrides) {
+    if (!overrides) {
+        return { ...json };
+    }
+    // Map resource type to override config section
+    const overrideSection = getOverrideSectionForType(descriptor.type, overrides);
+    if (!overrideSection) {
+        return { ...json };
+    }
+    // Find matching override using case-insensitive name comparison
+    const matchingKey = Object.keys(overrideSection).find((key) => key.toLowerCase() === getNameFromNameParts(descriptor.nameParts).toLowerCase());
+    if (!matchingKey) {
+        return { ...json };
+    }
+    const overrideValues = overrideSection[matchingKey];
+    if (overrideValues === null || overrideValues === undefined || typeof overrideValues !== 'object') {
+        return { ...json };
+    }
+    // ARM resources have all overridable fields inside 'properties'
+    // Wrap the override values inside 'properties' to merge at the correct level
+    const wrappedOverride = { properties: overrideValues };
+    // Deep-merge the override into the resource JSON
+    const result = deepMerge(json, wrappedOverride);
+    logger.debug(`Applied overrides to ${descriptor.type} '${descriptor.nameParts.join('/')}'`, { overrideKeys: Object.keys(overrideValues) });
+    return result;
+}
+/**
+ * Get the override section for a given resource type.
+ * Returns the relevant Record<string, Override> map or undefined.
+ */
+function getOverrideSectionForType(type, overrides) {
+    switch (type) {
+        case ResourceType.NamedValue:
+            return overrides.namedValues;
+        case ResourceType.Backend:
+            return overrides.backends;
+        case ResourceType.Api:
+            return overrides.apis;
+        case ResourceType.Diagnostic:
+            return overrides.diagnostics;
+        case ResourceType.Logger:
+            return overrides.loggers;
+        default:
+            return undefined;
+    }
+}
+/**
+ * Deep-merge two objects recursively.
+ * - Objects are merged recursively
+ * - Arrays are replaced (not merged)
+ * - Primitives from source override target
+ * - Returns a new object (immutable)
+ *
+ * @param target - Base object
+ * @param source - Override object
+ * @returns New merged object
+ */
+function deepMerge(target, source) {
+    const result = { ...target };
+    for (const [key, sourceValue] of Object.entries(source)) {
+        const targetValue = result[key];
+        // If both are plain objects, merge recursively
+        if (isPlainObject(sourceValue) &&
+            isPlainObject(targetValue)) {
+            result[key] = deepMerge(targetValue, sourceValue);
+        }
+        else {
+            // Otherwise replace (arrays, primitives, or type mismatch)
+            result[key] = sourceValue;
+        }
+    }
+    return result;
+}
+/**
+ * Check if a value is a plain object (not an array, null, or other special object).
+ */
+function isPlainObject(value) {
+    return (typeof value === 'object' &&
+        value !== null &&
+        !Array.isArray(value) &&
+        Object.prototype.toString.call(value) === '[object Object]');
+}
+//# sourceMappingURL=override-merger.js.map

package/dist/services/override-merger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"override-merger.js","sourceRoot":"","sources":["../../src/services/override-merger.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAE3D,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAE/D;;;;;;;;;;GAUG;AACH,MAAM,UAAU,cAAc,CAC5B,UAA8B,EAC9B,IAA6B,EAC7B,SAAqC;IAErC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;IACrB,CAAC;IAED,+CAA+C;IAC/C,MAAM,eAAe,GAAG,yBAAyB,CAAC,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC9E,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;IACrB,CAAC;IAED,gEAAgE;IAChE,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,IAAI,CACnD,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,oBAAoB,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CACxF,CAAC;IAEF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;IACrB,CAAC;IAED,MAAM,cAAc,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;IACpD,IAAI,cAAc,KAAK,IAAI,IAAI,cAAc,KAAK,SAAS,IAAI,OAAO,cAAc,KAAK,QAAQ,EAAE,CAAC;QAClG,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;IACrB,CAAC;IAED,gEAAgE;IAChE,6EAA6E;IAC7E,MAAM,eAAe,GAAG,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC;IAEvD,iDAAiD;IACjD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;IAEhD,MAAM,CAAC,KAAK,CACV,wBAAwB,UAAU,CAAC,IAAI,KAAK,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAC7E,EAAE,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAC9C,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,SAAS,yBAAyB,CAChC,IAAkB,EAClB,SAAyB;IAEzB,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,YAAY,CAAC,UAAU;YAC1B,OAAO,SAAS,CAAC,WAAW,CAAC;QAC/B,KAAK,YAAY,CAAC,OAAO;YACvB,OAAO,SAAS,CAAC,QAAQ,CAAC;QAC5B,KAAK,YAAY,CAAC,GAAG;YACnB,OAAO,SAAS,CAAC,IAAI,CAAC;QACxB,KAAK,YAAY,CAAC,UAAU;YAC1B,OAAO,SAAS,CAAC,WAAW,CAAC;QAC/B,KAAK,YAAY,CAAC,MAAM;YACtB,OAAO,SAAS,CAAC,OAAO,CAAC;QAC3B;YACE,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,SAAS,CAChB,MAA+B,EAC/B,MAA+B;IAE/B,MAAM,MAAM,GAA4B,EAAE,GAAG,MAAM,EAAE,CAAC;IAEtD,KAAK,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACxD,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAEhC,+CAA+C;QAC/C,IACE,aAAa,CAAC,WAAW,CAAC;YAC1B,aAAa,CAAC,WAAW,CAAC,EAC1B,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,GAAG,SAAS,CACrB,WAAsC,EACtC,WAAsC,CACvC,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,2DAA2D;YAC3D,MAAM,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACrB,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,iBAAiB,CAC5D,CAAC;AACJ,CAAC"}

package/dist/services/product-extractor.d.ts

@@ -0,0 +1,26 @@
+/**
+ * T023: Product-specific extraction logic
+ * Product associations (apis.json, groups.json, tags.json), product policies, product wikis.
+ */
+import { IApimClient } from '../clients/iapim-client.js';
+import { IArtifactStore } from '../clients/iartifact-store.js';
+import { ApimServiceContext, ResourceDescriptor } from '../models/types.js';
+import { FilterConfig } from '../models/config.js';
+/**
+ * Result of product-specific extraction for a single product.
+ */
+export interface ProductExtractionResult {
+    productName: string;
+    apis: string[];
+    groups: string[];
+    policy: string | undefined;
+    wiki: boolean;
+    tags: string[];
+    policies: string[];
+}
+/**
+ * Extract all product-specific resources for a single product.
+ * This includes API associations, group associations, policies, and wikis.
+ */
+export declare function extractProductResources(client: IApimClient, store: IArtifactStore, context: ApimServiceContext, productDescriptor: ResourceDescriptor, outputDir: string, _filter?: FilterConfig, _workspace?: string): Promise<ProductExtractionResult>;
+//# sourceMappingURL=product-extractor.d.ts.map

package/dist/services/product-extractor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"product-extractor.d.ts","sourceRoot":"","sources":["../../src/services/product-extractor.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAE5E,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAKnD;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,cAAc,EACrB,OAAO,EAAE,kBAAkB,EAC3B,iBAAiB,EAAE,kBAAkB,EACrC,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,YAAY,EACtB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,uBAAuB,CAAC,CAyClC"}